ISO 37001 gifts and hospitality: thresholds, donations and the register

What does ISO 37001 require for gifts and hospitality?

For ISO 37001 gifts and hospitality, the requirement sits in clause 8.7, "Gifts, hospitality, donations and similar benefits". It asks the organisation to put procedures in place so that none of these benefits is offered, provided or accepted as a bribe.

Clause 8.7 does not stand on its own. The procedure draws on the bribery risk assessment in 4.5 for its limits, on the anti-bribery policy in 5.2 for its prohibitions, on awareness and training in 7.3 so that people know the rules, and on the financial and non-financial controls in 8.3 and 8.4 so that a hospitality bill cannot be paid without the record existing. When a control proves too weak, 8.8 on managing inadequacy of controls applies; when someone suspects abuse, the reporting channel in 8.9 is the route. The requirements guide covers each of those clauses in full.

Two points shape the whole design. First, the procedure covers benefits given by your personnel and business associates acting for you, and benefits offered to them. Second, the measures must be reasonable and proportionate to the risk: a firm that never deals with public officials needs a lighter procedure than one that bids for government contracts every month.

Which benefits the procedure has to cover

The clause title names four things and then widens the net with "similar benefits". In practice the procedure should list what your organisation treats as a benefit, so nobody can argue that a paid trip or a job offer to a relative fell outside it. The table sets out the categories most procedures name and the control each usually attracts.

How do you set your own thresholds?

A threshold is the value above which a benefit needs approval, and a second, higher value above which it is refused or goes to the anti-bribery function. Because the standard leaves the figures to you, the auditor will ask where yours came from.

Start from the risk assessment

The bribery risk assessment already rates your countries, business lines and counterparties. Use it to decide where limits are tight and where they can be looser. A team selling to public hospitals warrants a lower threshold than a head-office team with few outside contacts.

Test the figure against four questions

• Would the benefit be reasonable and customary for that market, role and occasion?
• Could the recipient feel obliged to return the favour in a decision?
• Does local law, a public body's code of conduct or a customer's own policy set a lower limit? If so, the lower limit applies.

Add rules that are not about value

Value alone misses the pattern. Most procedures add a frequency rule (several modest gifts from one supplier in a year are treated as one larger gift), a timing rule (nothing to or from anyone involved in a live tender or contract negotiation), a public-official rule (every benefit pre-approved, whatever its value) and an outright ban on cash or anything that works like cash. Where local gifting customs are strong, write the customary occasions into the procedure rather than pretending they do not exist, and give people a polite way to decline.

A worked example: an engineering contractor

Take a mid-sized engineering contractor with offices in three countries. It bids for public infrastructure work, uses local agents in one country and buys materials from about two hundred suppliers. Its risk assessment rates public-sector tenders and the agent relationships as high risk, and routine supplier contact as low to medium.

The contractor sets two value bands in its own currency, reviewed each year by the anti-bribery function, and builds the procedure around them.

The register: what it records and what auditors test

The register is where clause 8.7 becomes visible. Each entry should show the date, the giver and the recipient with their organisations and roles, what was offered, an estimated value, the business purpose, whether it was accepted, refused or handed over, who approved it and when. Declined offers matter as much as accepted ones: a register with no refusals in a high-risk market suggests either unusual restraint or that people are not recording.

Auditors pick hospitality and gift lines from the ledger or expense claims and trace them back to entries, check that approvals came before the event, look for a pattern of benefits around a contract award. For donations and sponsorships they ask for the recipient checks, which overlap with the due diligence on business associates, and for evidence that the money reached the stated purpose. The register is documented information under 7.5, so it needs an owner, access control and a retention period.

Where gifts and hospitality controls fail

• A limit with no rationale. The figure is borrowed, and nobody can link it to the risk assessment.
• Only outgoing benefits covered. Procurement staff receive hampers and invitations that nobody records.
• Approval after the event. The manager signs a form once the dinner has happened, which is a record, not a control.
• Register and ledger never compared. Hospitality is paid through expense claims or a corporate card with no link to the register.
• Donations treated as corporate social responsibility. The charity is chosen by a regional manager, and nobody checks who runs it.
• No review. The anti-bribery function never analyses the register for patterns, so the data sits unused until the audit.

ISO 37001 gifts and hospitality: questions buyers ask